CVE-2024-53384
📋 TL;DR
This DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to inject malicious scripts that can execute arbitrary code when users interact with affected web applications. It affects any application using this specific version of tsup's bundling tool, potentially compromising user sessions and data.
💻 Affected Systems
- tsup
📦 What is this software?
Tsup by Egoist
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Cross-site scripting (XSS) attacks leading to session hijacking, credential theft, and client-side data manipulation.
If Mitigated
Limited impact with proper content security policies and input sanitization preventing script execution.
🎯 Exploit Status
Proof of concept available in GitHub gist, exploitation requires user interaction with crafted web page
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v8.3.5 or later
Vendor Advisory: https://github.com/egoist/tsup/security/advisories
Restart Required: No
Instructions:
1. Check current tsup version: npm list tsup
2. Update tsup: npm update tsup@latest
3. Rebuild your project: npm run build
4. Verify update: npm list tsup
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd strict CSP headers to prevent script execution from untrusted sources
Content-Security-Policy: script-src 'self'
Input Sanitization
allSanitize all user inputs and implement output encoding
🧯 If You Can't Patch
- Implement strict Content Security Policy with script-src directives
- Use subresource integrity (SRI) for all external scripts
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list tsup | grep 8.3.4Check Version:
npm list tsupVerify Fix Applied:
Verify tsup version is 8.3.5 or higher: npm list tsup | grep -v 8.3.4📡 Detection & Monitoring
Log Indicators:
- Unusual script loading patterns
- DOM manipulation events from unexpected sources
- Import.meta.url usage with document.currentScript
Network Indicators:
- Suspicious script sources in HTTP requests
- Unusual Content-Type headers for scripts
SIEM Query:
source="web_logs" AND (uri="*.js" OR uri="*.ts") AND (message="import.meta.url" OR message="document.currentScript")